MinIO

Storage · products/minio.yaml · RSS

Latest RELEASE.2025-10-15T17-29-55Z Oct 16, 2025

Recent releases

RELEASE.2025-10-15T17-29-55Z Oct 16, 2025 Release notes ↗ 6fix1feature

RELEASE.2025-09-07T16-13-09Z Sep 7, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 14fix1feature

RELEASE.2025-07-23T15-54-02Z Jul 23, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 1feature2fix

RELEASE.2025-07-18T21-56-31Z Jul 18, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 2fix

RELEASE.2025-06-13T11-33-47Z Jun 23, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 5fix4feature

RELEASE.2025-05-24T17-08-30Z May 24, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 10feature5fix1deprecated1breaking

breakingremove support for FIPS 140-2 with boringcrypto

RELEASE.2025-04-22T22-12-26Z Apr 22, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 5fix

RELEASE.2025-04-08T15-41-24Z Apr 8, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗

RELEASE.2025-04-03T14-56-28Z Apr 3, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 1security7fix2feature

securityRefer to CVE-2025-31489

RELEASE.2025-03-12T18-04-18Z Mar 12, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗

RELEASE.2025-02-28T09-55-16Z Feb 28, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 1security4fix2feature

securityThis release contains a fix for the security vulnerability that is the subject of this advisory: https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58. All deployments with SFTP access using LDAP as identity provider are advised to upgrade immediately.

RELEASE.2025-02-18T16-25-55Z Feb 18, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 3fix

RELEASE.2025-02-07T23-21-09Z Feb 8, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 2feature1fix

RELEASE.2025-02-03T21-03-04Z Feb 4, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 2feature1fix

RELEASE.2025-01-20T14-49-07Z Jan 21, 2025 → RELEASE.2025-10-15T17-29-55Z Release notes ↗ 1feature

Security advisories

6.9 CVE-2026-42600 Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

8.8 CVE-2026-41145 Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

8.8 CVE-2026-40344 Unauthenticated Object Write via Missing Signature Verification in Snowball Auto-Extract

7.1 CVE-2026-39414 DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

7.1 CVE-2026-34204 SSE Metadata Injection via Replication Headers

9.1 CVE-2026-33419 LDAP login brute-force via user enumeration and missing rate limit

9.2 CVE-2026-33322 JWT Algorithm Confusion in OIDC Authentication

8.1 CVE-2025-62506 Privilege Escalation via Session Policy Bypass in Service Accounts and STS

high CVE-2025-31489 incomplete signature validation for unsigned-trailer uploads

medium CVE-2025-27414 SFTP authentication bypass due to improperly trusted SSH key

critical CVE-2024-55949 Privilege escalation in IAM import API

5.3 CVE-2024-36107 Information disclosure in GetObject with If-Modified-Since, If-Unmodified-Since headers

8.8 CVE-2024-24747 Implicit allow for Access keys to inherit `admin:UpdateServiceAccount` allows for privilege escalation

critical CVE-2023-28433 Privilege Escalation on Windows via Path separator manipulation

critical CVE-2023-28434 Privilege Escalation on Linux/MacOS

critical CVE-2023-28432 Information Disclosure in Cluster Deployment

medium CVE-2023-27589 Denial of access by an admin privileged user for root credential

high CVE-2023-25812 Privilege escalation allowing DELETE on resources on object locked buckets under Governance mode

high CVE-2022-35919 Authenticated requests for server update admin API allows path traversal

high CVE-2022-31028 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients

Recent releases

Security advisories

Sources